3.03_Amendment_0005_N0010425RK073.pdf

R

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers is extended. is not extended.

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended, by one of the following methods:

(a) By completing items 8 and 15, and returning copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted;

or (c) By separate letter or electronic communication which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by letter or electronic communication, provided each letter or electronic communication makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. ACCOUNTING AND APPROPRIATION DATA (If required)

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS.

IT MODIFIES THE CONTRACT/ORDER NUMBER AS DESCRIBED IN ITEM 14.

CHECK ONE A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT ORDER

NUMBER IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation data, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor is not is required to sign this document and return copies to the issuing office.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER (Type or print) 16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

15B. CONTRACTOR/OFFEROR

(Signature of person authorized to sign)

15C. DATE SIGNED 16B. UNITED STATES OF AMERICA

(Signature of Contracting Officer)

16C. DATE SIGNED

Previous edition unusable STANDARD FORM 30 (REV. 11/2016) Prescribed by GSA FAR (48 CFR) 53.243

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT 1. CONTRACT ID CODE PAGE OF PAGES

2. AMENDMENT/MODIFICATION NUMBER 3. EFFECTIVE DATE 4. REQUISITION/PURCHASE REQUISITION NUMBER 5. PROJECT NUMBER (If applicable)

6. ISSUED BY CODE 7. ADMINISTERED BY (If other than Item 6) CODE

8. NAME AND ADDRESS OF CONTRACTOR (Number, street, county, State and ZIP Code) (X) 9A. AMENDMENT OF SOLICITATION NUMBER

9B. DATED (SEE ITEM 11)

10A. MODIFICATION OF CONTRACT/ORDER NUMBE

10B. DATED (SEE ITEM 13)

CODE FACILITY CODE

SECTION SF 30 BLOCK 14 CONTINUATION PAGE

SUMMARY OF CHANGES

Section A - Solicitation/Contract Form

The following changes have been made:

INFORMATION FROM TO

Response Due Date 05 Feb 2026 04 May 2026

N0010425RK0730005

Section F - Deliveries or Performance

The following clauses were deleted:

FAR Clauses Incorporated by Reference

Number Title Effective Date Alternate/ Deviation

Variation Effective Date

52.247-59 F.o.b. Origin-Carload and Truckload Shipments. Apr 1984 52.247-65 F.o.b. Origin, Prepaid Freight-Small Package Shipments. Jan 1991

Section I - Contract Clauses

Miscellaneous text in this section has been deleted.

Additional Information/Notes

The following clauses were added:

FAR Clauses Incorporated by Full Text

52.240-91 Security Prohibitions and Exclusions. (Deviation) (Feb 2026)

SECURITY PROHIBITIONS AND EXCLUSIONS (FEB 2026) (DEVIATION)

(a) As used in this clause-Definitions.

American Security Drone Act-covered foreign entity means an entity included on a list that the Federal Acquisition Security Council (FASC) develops and maintains and publishes in the System for Award Management (SAM) at https://www.sam.gov (section 1822 of Pub. L. 118-31, 41 U.S.

C. 3901 note prec.).

Backhaul means intermediate links between the core network, or backbone network, and the small subnetworks at the edge of the network (e.g., connecting cell phones/towers to the core telephone network). Backhaul can be wireless (e.g., microwave) or wired (e.g., fiber optic, coaxial cable, Ethernet).

Covered application means the social networking service TikTok or any successor application or service developed or provided by ByteDance Limited or an entity owned by ByteDance Limited.

Covered article, as defined in 41 U.S.C. 4713(k), means:

(1) Information technology, as defined in 40 U.S.C. 11101, including cloud computing services of all types;

(2) Telecommunications equipment or telecommunications service, as those terms are defined in section 3 of the Communications Act of 1934 (47 U.S.C. 153);

(3) The processing of information on a Federal or non-Federal information system, subject to the requirements of the Controlled Unclassified Information program (see 32 CFR part 2002); or

(4) Hardware, systems, devices, software, or services that include embedded or incidental information technology.

Covered foreign country means The People's Republic of China.

Covered telecommunications equipment or services means-

(1) Telecommunications equipment produced by Huawei Technologies Company or ZTE Corporation (or any subsidiary or affiliate of such entities);

(2) For the purpose of public safety, security of Government facilities, physical security surveillance of critical infrastructure, and other national security purposes, video surveillance and telecommunications equipment produced by Hytera Communications Corporation, Hangzhou Hikvision Digital Technology Company, or Dahua Technology Company (or any subsidiary or affiliate of such entities);

(3) Telecommunications or video surveillance services provided by such entities or using such equipment; or

(4) Telecommunications or video surveillance equipment or services produced or provided by an entity that the Secretary of Defense, in consultation with the Director of National Intelligence or the Director of the Federal Bureau of Investigation, reasonably believes to be an entity owned or controlled by, or otherwise connected to, the government of a covered foreign country.

Critical technology means-

(1) Defense articles or defense services included on the United States Munitions List set forth in the International Traffic in Arms Regulations under subchapter M of chapter I of title 22, Code of Federal Regulations;

(2) Items included on the Commerce Control List set forth in Supplement No. 1 to part 774 of the Export Administration Regulations under subchapter C of chapter VII of title 15, Code of Federal Regulations, and controlled-

(i) Pursuant to multilateral regimes, including for reasons relating to national security, chemical and biological weapons proliferation, nuclear nonproliferation, or missile technology; or

(ii) For reasons relating to regional stability or surreptitious listening;

(3) Specially designed and prepared nuclear equipment, parts and components, materials, software, and technology covered by part 810 of title 10, Code of Federal Regulations (relating to assistance to foreign atomic energy activities);

(4) Nuclear facilities, equipment, and material covered by part 110 of title 10, Code of Federal Regulations (relating to export and import of nuclear equipment and material);

(5) Select agents and toxins covered by part 331 of title 7, Code of Federal Regulations, part 121 of title 9 of such Code, or part 73 of title 42 of such Code; or

(6) Emerging and foundational technologies controlled pursuant to section 1758 of the Export Control Reform Act of 2018 (50 U.S.C. 4817).

FASC-prohibited unmanned aircraft system means an unmanned aircraft system manufactured or assembled by an American Security Drone Act-covered foreign entity.

FASCSA order means any of the following orders issued under the Federal Acquisition Supply Chain Security Act (FASCSA) requiring removing covered articles from executive agency information systems or excluding one or more named sources or named covered articles from executive agency procurement actions, as described in 41 CFR 201-1.303(d) and (e):

(1) The Secretary of Homeland Security may issue FASCSA orders that apply to civilian agencies, to the extent not covered by paragraph (2) or

(3) of this definition. This type of FASCSA order may be referred to as a Department of Homeland Security (DHS) FASCSA order.

(2) The Secretary of Defense may issue FASCSA orders that apply to the Department of Defense (DoD) and national security systems other than sensitive compartmented information systems. This type of FASCSA order may be referred to as a DoD FASCSA order.

(3) The Director of National Intelligence (DNI) may issue FASCSA orders that apply to the intelligence community and sensitive compartmented information systems, to the extent not covered by paragraph (2) of this definition. This type of FASCSA order may be referred to as a DNI FASCSA order.

Information technology, as defined in 40 U.S.C. 11101(6)-

(1) Means any equipment or interconnected system or subsystem of equipment, used in the automatic acquisition, storage, analysis, evaluation, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data or information by the executive agency, if the equipment is used by the executive agency directly or is used by a contractor under a contract with the executive agency that requires the use-

(i) Of that equipment; or

(ii) Of that equipment to a significant extent in the performance of a service or the furnishing of a product;

(2) Includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources; but

(3) Does not include any equipment acquired by a Federal contractor incidental to a Federal contract.

Intelligence community, as defined by 50 U.S.C. 3003(4), means the following-

(1) The Office of the Director of National Intelligence;

(2) The Central Intelligence Agency;

(3) The National Security Agency;

(4) The Defense Intelligence Agency;

(5) The National Geospatial-Intelligence Agency;

(6) The National Reconnaissance Office;

(7) Other offices within the Department of Defense for the collection of specialized national intelligence through reconnaissance programs;

(8) The intelligence elements of the Army, the Navy, the Air Force, the Marine Corps, the Coast Guard, the Federal Bureau of Investigation, the Drug Enforcement Administration, and the Department of Energy;

(9) The Bureau of Intelligence and Research of the Department of State;

(10) The Office of Intelligence and Analysis of the Department of the Treasury;

(11) The Office of Intelligence and Analysis of the Department of Homeland Security; or

(12) Such other elements of any department or agency as may be designated by the President, or designated jointly by the Director of National Intelligence and the head of the department or agency concerned, as an element of the intelligence community.

Interconnection arrangements means arrangements governing the physical connection of two or more networks to allow the use of another's network to hand off traffic where it is ultimately delivered (e.g., connecting a customer of telephone provider A to a customer of telephone company B) or sharing data and other information resources.

Kaspersky Lab-covered article means any hardware, software, or service that-

(1) Is developed or provided by a Kaspersky Lab-covered entity;

(2) Includes any hardware, software, or service developed or provided in whole or in part by a Kaspersky Lab-covered entity; or

(3) Contains components using any hardware or software developed in whole or in part by a Kaspersky Lab-covered entity.

Kaspersky Lab-covered entity means-

(1) Kaspersky Lab;

(2) Any successor entity to Kaspersky Lab, including any change in name, e.g., "Kaspersky";

(3) Any entity that controls, is controlled by, or is under common control with Kaspersky Lab; or

(4) Any entity of which Kaspersky Lab has a majority ownership.

National security system, as defined in 44 U.S.C. 3552, means any information system (including any telecommunications system) used or operated by an agency or by a contractor of an agency, or other organization on behalf of an agency-

(1) The function, operation, or use of which involves intelligence activities; involves cryptologic activities related to national security; involves command and control of military forces; involves equipment that is an integral part of a weapon or weapons system; or is critical to the direct fulfillment of military or intelligence missions, but does not include a system that is to be used for routine administrative and business applications (including payroll, finance, logistics, and personnel management applications); or

(2) Is protected at all times by procedures established for information that have been specifically authorized under criteria established by an Executive order or an Act of Congress to be kept classified in the interest of national defense or foreign policy.

Roaming means cellular communications services (e.g., voice, video, data) received from a visited network when unable to connect to the facilities of the home network either because signal coverage is too weak or because traffic is too high.

Sensitive compartmented information means classified information concerning or derived from intelligence sources, methods, or analytical processes, which is required to be handled within formal access control systems established by the Director of National Intelligence.

Sensitive compartmented information system means a national security system authorized to process or store sensitive compartmented information.

Source means a non-Federal supplier, or potential supplier, of products or services, at any tier.

Subsidiary means an entity in which more than 50 percent of the entity is owned directly by a parent corporation or through another subsidiary of a parent corporation.

Substantial or essential component means any component necessary for the proper function or performance of a piece of equipment, system, or service.

Unmanned aircraft means an aircraft that is operated without the possibility of direct human intervention from within or on the aircraft (49 U.S.C.

44801(11)).

Unmanned aircraft system means an unmanned aircraft and associated elements (including communication links and the components that control the unmanned aircraft) that are required for the operator to operate safely and efficiently in the national airspace system (49 U.S.C. 44801(12)).

(b) . Unless a waiver or exception applies, the Prohibitions on providing or using specific products or services in performance of contract Contractor is prohibited from providing any products or services to the Government or using in the performance of the contract any of the following:

(1) A covered application on any information technology owned or managed by the Government, or on any information technology used or provided by the Contractor under this contract, including equipment provided by the Contractor's employees (section 102 of Division R of the Consolidated Appropriations Act, 2023 (Pub. L. 117-328));

(2) A Kaspersky Lab-covered article (Section 1634 of Division A of the National Defense Authorization Act for Fiscal Year 2018 (Pub. L. 115- 91));

(3) Covered telecommunications equipment or services used as a substantial or essential component of any system, or as critical technology as part of any system (paragraphs (a)(1)(A) of section 889 of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 (Pub. L. 115- 232)). This does not prohibit contractors from providing-

(i) A service that connects to the facilities of a third-party, such as backhaul, roaming, or interconnection arrangements; or

(ii) Telecommunications equipment that cannot route or redirect user data traffic or cannot permit visibility into any user data or packets that such equipment transmits or otherwise handles.

(c) Prohibition on unmanned aircraft systems manufactured or assembled by American Security Drone Act-covered foreign entities.

(1) Prohibition. The Contractor is prohibited from-

(i) Delivering any FASC-prohibited unmanned aircraft system, which includes unmanned aircraft (i.e., drones) and associated elements (sections 1823 and 1826 of American Security Drone Act of 2023, within the National Defense Authorization Act for Fiscal Year 2024, Pub. L. 118-31, Div.

A, Title XVIII, Subtitle B, 41 U.S.C. 3901 note prec.);

(ii) On or after December 22, 2025, operating a FASC-prohibited unmanned aircraft system in the performance of the contract (section 1824 of Pub. L. 118-31); and

(iii) On or after December 22, 2025, using Federal funds to procure or operate a FASC-prohibited unmanned aircraft system (section 1825 of Pub.

L. 118-31).

(2) . The Contractor shall search SAM for the FASC-maintained list of American Security Drone Act-covered foreign entities before Procedures proposing, or using in performance of the contract, any unmanned aircraft system. Also, the Contractor shall ensure any effort or expenditure associated with a FASC-prohibited unmanned aircraft system is consistent with a corresponding exemption, exception, or waiver determination expressly stated in the contract.

(3) . The prohibitions in paragraph (c) of this clause do not apply where the agency has determined an Exemptions, exceptions, and waivers exemption, exception, or waiver applies, and the contract indicates that such a determination has been made. See sections 1823 through 1825 and 1832 of Public Law 118-31 for statutory requirements pertaining to exemptions, exceptions, and waivers.

(d) .Prohibition on using or providing specific products or services or conducting certain transactions regardless of connection to contract

(1) .Certain telecommunications and video surveillance equipment, systems, or services

(i) Unless an applicable waiver has been issued by the Government, the Contractor cannot use any equipment, systems, or services that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system (paragraph (a)(1)(B) of section 889 of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 (Pub. L. 115-232)).

(ii) This prohibition applies to using covered telecommunications equipment or services, regardless of whether that use is in performance of work under a Federal contract. This does not prohibit the contractor from using-

(A) A service that connects to the facilities of a third party, such as backhaul, roaming, or interconnection arrangements; or

(B) Telecommunications equipment that cannot route or redirect user data traffic or cannot permit visibility into any user data or packets that such equipment transmits or otherwise handles.

(2) .Office of Foreign Assets Control Restrictions

(i) Except as authorized by the Office of Foreign Assets Control (OFAC) in the Department of the Treasury, the Contractor shall not acquire, for use in the performance of this contract, any supplies or services if any proclamation, Executive order, or statute administered by OFAC, or if OFAC's implementing regulations at 31 CFR chapter V, would prohibit such a transaction by a person subject to the jurisdiction of the United States.

(ii) Except as authorized by OFAC, most transactions involving Cuba, Iran, and Sudan are prohibited, as are most imports from Burma or North Korea, into the United States or its outlying areas.

(A) For lists of entities and individuals subject to economic sanctions, see OFAC's List of Specially Designated Nationals and Blocked Persons at https://home.treasury.gov/policy-issues/financial-sanctions/specially-designated-nationals-and-blocked-persons-list-sdn-human-readable-lists.

(B) For more information about these restrictions, as well as updates, see OFAC's regulations at 31 CFR chapter V and at https://home.treasury.gov /policy-issues/office-of-foreign-assets-control-sanctions-programs-and-information.

(C) To conduct electronic screens of potential parties to regulated transactions, see the consolidated screening list at https://www.trade.gov /consolidated-screening-list, which consolidates multiple export screening lists of the Departments of Commerce, State, and the Treasury.

(3) . The Contractor is prohibited from conducting any restricted business operations in Sudan in accordance with Accountability Sudan prohibition and Divestment Act of 2007 (Pub. L. 110-174).

(4) .Iran prohibitions

(i) Unless an exception applies according to paragraph (d)(4)(iii) or the Government grants a waiver, the contractor shall not engage in certain activities or transactions relating to Iran (section 6(b)(1)(A) of Iran Sanctions Act (50 U.S.C. 1701 note).

(ii) Unless an exception applies according to paragraph (d)(4)(iii) or the Government grants a waiver, contractor shall not export certain sensitive technology to Iran, as determined by the President, and has an active exclusion in SAM (22 U.S.C. 8515).

(iii) The prohibition in paragraphs (d)(4)(i) and (d)(4)(ii) do not apply if the acquisition is subject to trade agreements and the offeror certifies that all the offered products are designated country end products or designated country construction material (see part 25).

(iv) Unless an exception applies or the Government grants a waiver, contractors are prohibited from knowingly engaging in any significant transaction (i.e., over $15,000) with Iran's Revolutionary Guard Corps or any of its officials, agents, or affiliates, the property and interests in property of which are blocked according to the International Emergency Economic Powers Act (section 6(b)(1)(B) of Iran Sanctions Act (50 U.S.C. 1701 note)).

(e) .Governmentwide exclusion and removal orders

(1) Unless the Government has issued an applicable waiver, contractors shall not provide or use as part of the performance of the contract any covered article, or any products or services produced or provided by a source, if the covered article or the source is prohibited by an applicable FASCSA order as follows:

(i) For solicitations and contracts awarded by a Department of Defense contracting office, DoD FASCSA orders apply.

(ii) For all other solicitations and contracts, DHS FASCSA orders apply.

(2) The Contractor shall search for the phrase "FASCSA order" in the System for Award Management (SAM) at https://www.sam.gov to locate applicable FASCSA orders.

(3) The Government may identify in the solicitation other FASCSA orders that are not in SAM, which are effective and apply to the solicitation and resulting contract.

(4) A FASCSA order issued after the date of solicitation applies to this contract only if added by an amendment to the solicitation or modification to the contract (see FAR 40.204-1(c)).

(f) . The contractor shall conduct a reasonable inquiry to determine if there are any prohibited products or services. The inquiry Reasonable inquiry will look at any information in the entity's possession but does not need to include an internal or third-party audit.

(g) . For Federal Supply Schedules, Governmentwide acquisition contracts, multi-agency contracts or Removal of prohibited products and services any other procurement instrument intended for use by multiple agencies, upon notification from the Contracting Officer, during the performance of the contract, the Contractor shall promptly make any necessary changes or modifications to remove any product or service produced or provided by a source that this clause prohibits.

(h) .General report

(1) If the Contractor identifies or is notified by any source, (including a subcontractor at any tier), that any product or service provided or used (or to be provided or used) during contract performance does not comply with any prohibition in this clause, then the Contractor shall report the following information, or as much information is known, in writing to the contracting office as identified in paragraph (h)(2) within 72 hours:

(i) Contract number and order number, if applicable;

(ii) The specific prohibition the product or service is not complying with;

(iii) A description of the products or services that the Contractor identifies or has reason to suspect is prohibited (include brand; model number, such as the original equipment manufacturer (OEM) number, manufacturer part number, or wholesaler number; and item description, as applicable);

(iv) The entity that produced the product or service (include entity name, unique entity identifier, Contractor and Government Entity (CAGE) code, facilities responsible for design, fabrication, assembly, packaging, and test of the product, and whether the entity was the OEM or a distributor (provide manufacturer codes and distributor codes used for the product));

(v) Description of the functionality of the product or service and how that functionality impacts the risk to the product or service;

(vi) An explanation of any factors relevant to determining if the product or service should be permitted by an applicable exception, exemption, or waiver (if the contractor would like the Government to consider a waiver, and asks for such a waiver);

(vii) Whether alternative products or services are available that would comply with the prohibition;

(viii) If the product or service is related to item maintenance, include the following information on the item being maintained:

(A) Brand;

(B) Model number, OEM number, manufacturer part number, or wholesaler number; and

(C) Item description, as applicable.

(ix) Any readily available information about mitigation actions implemented or recommended.

(2) If a report must be submitted to a contracting office, the Contractor shall submit the report as follows:

(i) If a Department of Defense contracting office, the Contractor shall report to the website at https://dibnet.dod.mil.

(ii) For all other contracting offices, the Contractor shall report to the Contracting Officer.

(iii) For indefinite delivery contracts, the Contractor shall report to both the contracting office for the indefinite delivery contract and the contracting office for any affected order.

(3) If the report provided does not contain any of the information required by paragraph (h)(1) of this clause, and the contractor later discovers new information that is required by paragraph (h)(1) of this clause, then the contractor shall submit a subsequent report within 72 hours of discovering the new information.

(4) The contractor shall also report the information in paragraph (h)(1) if the contractor wishes to ask for a waiver of the requirements of a new FASCSA order being applied through modification.

(i) .New FASCSA orders report

(1) During contract performance, the Contractor shall review SAM at least once every three months, or as advised by the Contracting Officer, to check for covered articles subject to FASCSA order(s), or for products or services produced by a source subject to FASCSA order(s) not currently identified under paragraph (e) of this clause.

(2) If the Contractor identifies a new FASCSA order(s) that could impact their supply chain, then the Contractor shall conduct a reasonable inquiry to identify whether a covered article or product or service produced or provided by a source subject to the FASCSA order(s) was provided to the Government or used during contract performance. The inquiry will look at any information in the entity's possession but does not need to include an internal or third-party audit.

(3) The Contractor shall submit a report to the contracting office identified in paragraph (h)(2) of this clause if the Contractor identifies, including through any notification by a subcontractor at any tier, that a covered article or product or service produced or provided by a source was provided to the Government or used during contract performance and is subject to a FASCSA order(s). For indefinite delivery contracts, the Contractor shall report to both the contracting office for the indefinite delivery contract and the contracting office for any affected order. The Contractor shall report the following information within 72 hours for each covered article or each product or service produced or provided by a source, where the covered article or source is subject to a FASCSA order:

(i) Contract number and order number, if applicable;

(ii) Name of the covered article or source subject to a FASCSA order;

(iii) The specific FASCSA order the product or service does not comply with;

(iv) The elements of (h)(1)(iii) through (ix) of this clause.

(j) Subcontracts. The Contractor shall insert the substance of this clause, including this paragraph (j) but excluding subparagraphs (d)(1) and (i)(1), in all subcontracts and other contractual instruments, including subcontracts for acquiring commercial products or commercial services.

(End of clause)

52.240-93 Basic Safeguarding of Covered Contractor Information Systems. (Deviation) (Feb 2026)

BASIC SAFEGUARDING OF COVERED CONTRACTOR INFORMATION SYSTEMS (FEB 2026) (DEVIATION)

(a) Definitions. As used in this clause-

Covered contractor information system means an information system that is owned or operated by a contractor that processes, stores, or transmits Federal contract information.

Federal contract information-

(1) Means information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government; but

(2) Does not include information provided by the Government to the public (such as on public websites) or simple transactional information (such as information necessary to process payments).

Information means any communication or representation of knowledge such as facts, data, or opinions, in any medium or form, including textual, numerical, graphic, cartographic, narrative, or audiovisual (Committee on National Security Systems Instruction (CNSSI) 4009).

Information system means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information (44 U.S.C. 3502).

Safeguarding means measures or controls that are prescribed to protect information systems.

(b) .Safeguarding requirements

(1) Basic requirements. The Contractor shall safeguard its covered contractor information systems by implementing, at minimum, the following security controls:

(i) Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).

(ii) Limit information system access to the types of transactions and functions that authorized users are permitted to execute.

(iii) Verify and control/limit connections to and use of external information systems.

(iv) Control information posted or processed on publicly accessible information systems.

(v) Identify information system users, processes acting on behalf of users, or devices.

(vi) Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems.

(vii) Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reuse.

(viii) Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals.

(ix) Escort visitors and monitor visitor activity; maintain audit logs of physical access; and control and manage physical access devices.

(x) Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems.

(xi) Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.

(xii) Identify, report, and correct information and information system flaws in a timely manner.

(xiii) Provide protection from malicious code at appropriate locations within organizational information systems.

(xiv) Update malicious code protection mechanisms when new releases are available.

(xv) Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed.

(2) Other requirements. This clause does not relieve the Contractor of any other specific safeguarding requirements specified by Federal departments and agencies relating to covered contractor information systems generally or other Federal safeguarding requirements for controlled unclassified information (CUI) as established by Executive Order 13556.

(c) Subcontracts. The Contractor shall include the substance of this clause, including this paragraph (c), in subcontracts under this contract (including subcontracts for the acquisition of commercial products, other than commercially available off-the-shelf items, or commercial services), in which the subcontractor may have Federal contract information residing in or transiting through its information system.

(End of clause)

DFARS Clauses Incorporated by Reference

Alternate/ Variation

Number Title Effective Date Deviation Effective Date

252.227-7991 Rights in Bid or Proposal Information. (DEVIATION 2026-O0036) Feb 2026 Deviation 2026-O0036 Feb 2026 252.227-7996 Technical Data--Withholding of Payment. (DEVIATION 2026-O0036) Feb 2026 Deviation 2026-O0036 Feb 2026 252.227-7997 Validation of Asserted Restrictions. (DEVIATION 2026-O0036) Feb 2026 Deviation 2026-O0036 Feb 2026

252.240-7997 NIST SP 800-171 DoD Assessment Requirements. (DEVIATION 2026- O0025)

Feb 2026 Deviation 2026-O0025 Feb 2026

252.242-7999 Accounting System Administration. (DEVIATION 2026-O0050) Mar 2026 Deviation 2026-O0050 Mar 2026 252.246-7998 Warranty of Data. (DEVIATION 2026-O0035) Feb 2026 Deviation 2026-O0035 Feb 2026

DFARS Clauses Incorporated by Full Text

252.227-7989 Rights in Technical Data, Computer Software, and Computer Software Documentation--Other Than Commercial Products and Commercial Services. (DEVIATION 2026-O0036)

(Feb 2026) Deviation 2026-O0036 (Feb 2026)

RIGHTS IN TECHNICAL DATA, COMPUTER SOFTWARE, ANDCOMPUTER SOFTWARE DOCUMENTATION--OTHER THAN

COMMERCIAL PRODUCTS OR COMMERCIAL SERVICES(DEVIATION 2026-O0036) (FEB 2026)

(a) . As used in this clause--Definitions

"Commercial computer software" means software developed or regularly used for nongovernmental purposes which--

(1) Has been sold, leased, or licensed to the public;

(2) Has been offered for sale, lease, or license to the public;

(3) Has not been offered, sold, leased, or licensed to the public but will be available for commercial sale, lease, or license in time to satisfy the delivery requirements of this contract; or

(4) Satisfies a criterion expressed in paragraph (1), (2), or (3) of this definition and would require only minor modification to meet the requirements of this contract.

"Computer database" means a collection of data recorded in a form capable of being processed by a computer. The term does not include computer software.

"Computer program" means a set of instructions, rules, or routines recorded in a form that is capable of causing a computer to perform a specific operation or series of operations.

"Computer software" means computer programs, source code, source code listings, object code listings, design details, algorithms, processes, flow charts, formulae and related material that would enable the software to be reproduced, recreated, or recompiled. Computer software does not include computer databases or computer software documentation.

"Computer software documentation" means owner's manuals, user's manuals, installation instructions, operating instructions, and other similar items, regardless of storage medium, that explain the capabilities of the computer software or provide instructions for using the software.

"Covered Government support contractor" means a contractor (other than a litigation support contractor covered by 252.204-7014) under a contract, the primary purpose of which is to furnish independent and impartial advice or technical assistance directly to the Government in support of the Government's management and oversight of a program or effort, rather than to directly furnish an end item or service to accomplish a program or effort, provided that the contractor--

(1) Is not affiliated with the prime contractor or a first-tier subcontractor on the program or effort, or with any direct competitor of such prime contractor or any such first-tier subcontractor in furnishing end items or services of the type developed or produced on the program or effort; and

(2) Receives access to technical data or computer software for performance of a Government contract that contains the clause at 252.227- 7994, Limitations on the Use or Disclosure of Government-Furnished Information Marked with Restrictive Legends.

"Detailed manufacturing or process data" means technical data that describe the steps, sequences, and conditions of manufacturing, processing or assembly used by the manufacturer to produce an item or component or to perform a process.

"Developed" means--

(1) (Applicable to technical data other than computer software documentation.) An item, component, or process exists and is workable. Thus, the item or component must have been constructed or the process practiced. Workability is generally established when the item, component, or process has been analyzed or tested sufficiently to demonstrate to reasonable people skilled in the applicable art that there is a high probability that it will operate as intended. Whether, how much, and what type of analysis or testing is required to establish workability depends on the nature of the item, component, or process, and the state of the art. To be considered "developed," the item, component, or process need not be at the stage where it could be offered for sale or sold on the commercial market, nor must the item, component, or process be actually reduced to practice within the meaning of Title 35 of the United States Code;

(2) A computer program has been successfully operated in a computer and tested to the extent sufficient to demonstrate to reasonable persons skilled in the art that the program can reasonably be expected to perform its intended purpose;

(3) Computer software, other than computer programs, has been tested or analyzed to the extent sufficient to demonstrate to reasonable persons skilled in the art that the software can reasonably be expected to perform its intended purpose; or

(4) Computer software documentation the contractor must deliver under a contract has been written, in any medium, in sufficient detail to comply with requirements under that contract.

"Developed exclusively at private expense" means development was accomplished entirely with costs charged to indirect cost pools, costs not allocated to a Government contract, or any combination thereof.

(1) Private expense determinations should be made at the lowest practicable level.

(2) Under fixed-price contracts, when total costs are greater than the firm-fixed-price or ceiling price of the contract, the additional development costs necessary to complete development shall not be considered when determining whether development was at Government, private, or mixed expense.

"Developed exclusively with Government funds" means development was not accomplished exclusively or partially at private expense.

"Developed with mixed funding" means development was accomplished partially with costs charged to indirect cost pools and/or costs not allocated to a government contract, and partially with costs charged directly to a government contract.

"Form, fit, and function data" means technical data that describe the required overall physical, functional, and performance characteristics (along with the qualification requirements, if applicable) of an item, component, or process to the extent necessary to permit identification of physically and functionally interchangeable items.

"Generated" means, with regard to technical data or computer software, first created in the performance of this contract.

"Government purpose" means any activity in which the United States Government is a party, including cooperative agreements with international or multi-national defense organizations, or sales or transfers by the United States Government to foreign governments or international organizations.

Government purposes include competitive procurement, but do not include the rights to use, modify, reproduce, release, perform, display, or disclose technical data, computer software, or computer software documentation for commercial purposes or authorize others to do so.

"Government purpose rights" means the rights to--

(1) Use, modify, reproduce, release, perform, display, or disclose technical data, computer software, or computer software documentation within the Government without restriction; and

(2) Release or disclose technical data, computer software, or computer software documentation outside the Government and authorize persons to whom release or disclosure has been made to use, modify, reproduce, release, perform, display, or disclose that data or software for United States Government purposes.

"Limited rights" means the rights to use, modify, reproduce, release, perform, display, or disclose technical data, in whole or in part, within the Government. The Government may not, without the written permission of the party asserting limited rights, release or disclose the technical data outside the Government, use the technical data for manufacture, or authorize the technical data to be used by another party, except that the Government may reproduce, release, or disclose such data or authorize the use or reproduction of the data by persons outside the Government if--

(1) The reproduction, release, disclosure, or use is--

(i) Necessary for emergency repair and overhaul; or

(ii) A release or disclosure to--

(A) A covered Government support contractor in performance of its covered Government support contract for use, modification, reproduction, performance, display, or release or disclosure to a person authorized to receive limited rights technical data; or

(B) A foreign government, of technical data other than detailed manufacturing or process data, when use of such data by the foreign government is in the interest of the Government and is required for evaluational or informational purposes;

(2) The recipient of the technical data is subject to a prohibition on the further reproduction, release, disclosure, or use of the technical data;

and

(3) The contractor or subcontractor asserting the restriction is notified of such reproduction, release, disclosure, or use.

"Minor modification" means a modification that does not significantly alter the nongovernmental function or purpose of the software or is of the type customarily provided in the commercial marketplace.

"Other than commercial computer software" means software that does not qualify as commercial computer software under the definition of "commercial computer software" of this clause.

"Restricted rights" apply only to other than commercial computer software and mean the Government's rights to--

(1) Use a computer program with one computer at one time. The program may not be accessed by more than one terminal or central processing unit or time shared unless otherwise permitted by this contract;

(2) Transfer a computer program to another Government agency without the further permission of the Contractor if the transferor destroys all copies of the program and related computer software documentation in its possession and notifies the licensor of the transfer. Transferred programs remain subject to the provisions of this clause;

(3) Make a reasonable number of copies of the computer software required for the purposes of safekeeping (archive), backup, modification, or other activities authorized in paragraphs (1), (2), (4) and (5) of this definition;

(4) Modify computer software provided that the Government may--

(i) Use the modified software only as provided in paragraphs (1) and (3) of this definition; and

(ii) Not release or disclose the modified software except as provided in paragraphs (2) and (5) of this clause;

(5) Use, modify, reproduce, perform, display, or release or disclose the computer software, and permit contractors, subcontractors, or covered Government support contractors to do so, for purposes set forth in subparagraph (i) of this paragraph, subject to the conditions set forth in subparagraphs (ii) of this paragraph:

(i)(A) In performance of service contracts (see FAR 37.101), to diagnose and correct deficiencies, to modify the software to enable a computer program to be combined with, adapted to, or merged with other computer programs, or when necessary to respond to urgent tactical situations, provided that the Government notifies the party which has granted restricted rights that any such release or disclosure to particular contractors or subcontractors was made;

(B) To perform emergency repairs or overhaul of items or components procured under this or a related contract, when necessary to perform such repairs or overhaul; or

(C) For the management and oversight of a program or effort by a person authorized to receive restricted rights computer software, including in the performance of covered Government support contracts.

(ii)(A) Any contractor, subcontractor, or covered Government support contractor receiving access to the software for the purposes of subparagraphs (i), (ii), or (iii) of this paragraph shall be subject to the use and nondisclosure agreement at 227.7103-7 or be performing a Government contract that contains the clause at 252.227-7994, Limitations on the Use or Disclosure of Government-Furnished Information Marked with Restrictive Legends;

(B) The Government must not permit any recipient of the software under this paragraph to decompile, disassemble, or reverse engineer the software, or use software decompiled, disassembled, or reverse engineered by the Government pursuant to paragraph (4) of this definition, for any other purpose; and

(C) Any use, modification, reproduction, performance, display, release, or disclosure of the computer software under this paragraph remains subject to the limitations in paragraphs (1) through (4) of this definition.

"Small Business Innovation Research/Small Business Technology Transfer (SBIR/STTR) data" means all technical data or computer software developed or generated in the performance of a phase I, II, or III SBIR/STTR contract or subcontract.

"Technical data" means recorded information, regardless of the form or method of the recording, of a scientific or technical nature (including computer software documentation). The term does not include computer software or financial, administrative, cost or pricing, or management information, or information incidental to contract administration.

"Unlimited rights" means rights to use, modify, reproduce, perform, display, release, or disclose technical data, computer software, or computer software documentation in whole or in part, in any manner, and for any purpose whatsoever, and to have or authorize others to do so.

(b) . (1) Except as provided in paragraph (b)(2) of this clause--Applicability

(i) This clause governs all technical data related to other than commercial products or commercial services or to any portion of a commercial product or commercial service that was developed in any part at Government expense;

(ii) This clause governs all other than commercial computer software or other than commercial computer software documentation; and

(iii) The clause at DFARS 252.227-7990, Technical Data--Commercial Products and Commercial Services, governs the technical data related to any portion of a commercial product or commercial service that was developed exclusively at private expense.

(2) The clause at DFARS 252.227-7993, Rights in Other Than Commercial Technical Data and Computer Software--Small Business Innovation Research Program and Small Business Technology Transfer Program, governs technical data that are SBIR/STTR data.

(c) . The Contractor grants or shall obtain for the Government the following royalty free, Rights in technical data and computer software worldwide, nonexclusive, irrevocable license rights:

(1) . The Government shall have unlimited rights in technical data, computer software, or computer software documentation Unlimited rights that are--

(i) Data related to an item, component, or process which has been or will be developed exclusively with Government funds;

(ii) Studies, analyses, test data, or similar data produced for this contract, when the study, analysis, test, or similar work was specified as an element of performance;

(iii) Technical data created exclusively with Government funds in the performance of a contract that does not require the development, manufacture, construction, or production of items, components, or processes;

(iv) Form, fit, and function data;

(v) Technical data necessary for installation, operation, maintenance, or training purposes (other than detailed manufacturing or process data);

(vi) Government-furnished corrections or changes to--

(A) Technical data furnished to the Contractor by the Government; or

(B) Computer software or computer software documentation;

(vii) Data, computer software, or computer software documentation that is publicly available or previously released or disclosed by the Contractor or subcontractor without…